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DETAILED ACTION 
Response to Arguments 

1 . Applicant's arguments filed 4/16/04 have been fully considered but they are not 
persuasive. In response to the argument that an aggregator including the step of defining a rule 
chain is not taught by prior arts. In US Patent No. 6,405,25 1, Bullard teaches about the process 
of aggregating Network Accounting Records (NARs) (Col 16, lines 1-10) but does not explicitly 
teach about using a rule chain approach in aggregating the NARs. The information received in 
network account recording is of a heterogeneous nature and requires an aggregation process that 
incorporates this property. It would have been obvious to use a rule chain approach similar to the 
one taught in US Patent No. 5,970,490 by Morgenstern (Fig. 4), (Col 20, line 45-Col 22, line 67). 

2. In response to the argument that the aggregation process involves using more than one 
rule chain is not taught. Because of heterogeneous nature, the dependency and the different 
availability times of the Network Accounting Records, aggregation takes place in stages to match 
up with the gathering of the NARs. This approach is taught by Morgenstern (Fig. 4), (Col 20, 
line 45-Col 22, line 67). The rule chains as claimed are similar to the rule nodes as disclosed. 



Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 
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2. Claims 1-31 are rejected under 35 U.S.C. 103(a) as being unpatentable over US Patent 
No. 6,405,251 by Bullard et al in view of US patent No. 5,970,490 by Morgenstern. 

3. The factual inquiries set forth in Graham v. John Deere Co,, 383 U.S. 1, 148 USPQ 459 
(1966), that are applied for establishing a background for determining obviousness under 35 
U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating obviousness 
or nonobviousness. 

In claim 1, Bullard teaches about a method for recording network usage, the method 
comprising the steps of (Col 1, lines 15-30): 

defining a network data collector including an encapsulator " NAR processing (Fig 14, 
306, 302)", an aggregator, and a data storage system "Local store , (Fig 14, 314)", (Col 15, lines 
45-65), (Col 16, lines 1-10); 

receiving a set of network accounting data via the encapsulator (Col 15, lines 45-65); 

converting the network accounting data set to a standard data format "NAR format" (Col 
15, lines 45-65); 

storing the aggregated network accounting data set in the data storage system "Local 
store, (Fig 14, 314)", (Col 16, lines 1-10); and 

but does not explicitly teach processing the network accounting data set via the 
aggregator, including the steps of defining a rule chain and applying the rule chain to the 
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network accounting data set to construct an aggregation tree including creating an aggregated 
network accounting data set. 

The method of using a rule chain approach in the aggregation of heterogeneous database 
is well known in the art and is taught by Morgenstern (Fig. 4), (Col 20, line 45-Col 22, line 67). 
Morgenstern teaches about generating new data base node by match (Col 17, line 65-Col 18, line 
10) or filtering (Col 32, lines 50-65) a sequence of outputs. The process of gathering data occurs 
over a time period, which requires correlation of different data that occur at different time during 
the collection period. It is inherent because of the diverse nature of the information collected that 
different rule will be apply at different stages of the collection period as demonstrated by 
Morgenstern (Fig 4, 224) (Fig 4, 220),(Col 20, line 45-Col 22, line 67). It would have been 
obvious at the time of the invention for someone of ordinary skill to use a chain rule approach to 
aggregate data that are stored in a tree like structure to insure the accuracy of the final output 
data. 

In database like accounting record, data are organized base on their dependency to other 
data. This organization is naturally realized as a tree structure as disclosed by Morgenstern (Fig. 
4), (Col 20, lines 45-55). This concept is often used in data base management, which contains a 
root directory (main node), which is subdivided into subdirectory (limb node or leaf node). By 
organizing the data in a tree structure the dependency and the correlation of data is clearly 
represented which make the process of applying rules more define and accurate. By using a chain 
rule approach, it was guarantee that the final output had gone through the correct sequence of 
output generation base on its dependency to give the most accurate result (Col 22, lines 20-65). 
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Because of dependency, the final output has to be placed on hold until all the sequence of events 
that are used to generate the final output is available. 

In claim 2, Bullard combines with Morgenstern teaches about a method of claim 1, 
wherein the step of applying the rule chain to the network accounting data set to construct the 
aggregation tree includes the step of applying a rule from the rule chain to the network 
accounting data set to define a group node (Morgenstern (Col 20, lines 45-55), Covered in claim 

In claim 3, Bullard combines with Morgenstern teaches about a method of claim 2, 
wherein the rule is a match rule (Col 17, lines 35-40). 

In claim 4, Bullard combines with Morgenstern teaches about a method of claim 1 , 
wherein the step of applying the rule chain to the network accounting data set to construct the 
aggregation tree includes the step of applying a set of match rules to the network accounting data 
set to define a hierarchy of group nodes within the aggregation tree (Covered in claim 1), 

In claim 5, Bullard combines with Morgenstern teaches about a method of claim 4, 
wherein the step of applying the rule chain to the network accounting data set to construct the 
aggregation tree includes the step of applying an aggregation rule to the match group node to 
create the aggregated network accounting data set (Covered in claim 1). 

In claim 6, Bullard combines with Morgenstern teaches about a method of claim 1, 
wherein the step of applying the rule chain to the network accounting data set to construct the 
aggregation tree includes the step of applying a data manipulation rule "constructing NAR as 
appropriate" to the network accounting data set (Col 15, lines 60-65). 
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In claim 7, Bullard combines with Morgenstern teaches about a method of claim 6, 
further comprising the step of defining the data manipulation rule to be an adornment rule " 
enhancement" (Col 15, line45-Col 16, line 15). 

In claim 8, Bullard combines with Morgenstern teaches about a method of claim 6, 
further comprising the step of defining the data manipulation rule to be a filtering rule (Covered 
in claim 1). 

In claim 9, Bullard combines with Morgenstern teaches about a method of claim 1, 
wherein the network accounting data set is a set of session data (Col 8, lines 15-38), (Table 1). 

In claim 10, Bullard combines with Morgenstern teaches about a method of claim 1, 
wherein the network accounting data set is a set of usage data (Col 8, lines 15-38), (Table 1). 

In claim 11, Bullard teaches about a method of claim 1, further comprising the step of 
defining a data flush interval " associated with that entity over a specified period of time" (Col 
14, lines 45-50); and 

wherein the step of storing the aggregated network accounting data set includes the step 
of transferring the aggregated network accounting data to the data storage system after a period 
of time associated with the data flush interval (Col 16, lines 1-10). 

In claim 12, Bullard combines with Morgenstern teaches about a method of claim 1, 
further comprising the step of defining a rule within the rule chain by Java object class 
"relational database" , and allows additional rule types to be added to the rule chain 
corresponding to the Java object class (Morgenstern (Col 40, lines 45-60). 
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In claim 13, Bullard combines with Morgenstern teaches about a method for recording 
network usage including correlating of network usage information and network session 
information, the method comprising the steps of (Col 15, lines 45-67): 

defining a network data correlator collector including an encapsulator " NAR processing 
(Fig 14, 306, 302)", an aggregator, and a data storage system "Local store , (Fig 14, 314)" (Col 
15, lines 45-67), (Col 16, lines 1-10); 

receiving a set of network session data via the encapsulator (Col 15, lines 45-67), (Table 

i); 

processing the network session data set via the aggregator, including the steps of defining 
a first rule chain and applying the first rule chain (Morgenstern (Fig. 4, 224) to the network 
session data to construct an aggregation tree (Covered in claim 1); 

receiving a set of network usage data via the encapsulator (Col 15, lines 45-67), (Table 

i); 

processing the network usage data set via the aggregator, including the steps of defining a 
second rule chain (Morgenstern (Fig. 4, 220) and applying the second rule chain to the network 
usage data and the aggregation tree to construct a correlated aggregation tree (Covered in claim 

determining a correlated data set from the correlated aggregation tree (Covered in claim 

1); and 

storing the correlated data set in the data storage system (Col 16, lines 1-10). 
In claim 14, Bullard combines with Morgenstern teaches about a method of claim 13, 
wherein the network session data set is in a standard data format "NAR format" received from a 
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session data collector having an encapsulator " NAR processing (Fig 14, 306, 302)", an 
aggregator and a data storage system "Local store , (Fig 14, 314)", (Col 15, line 45-Col 16, line 
15). 

In claim 15, Bullard combines with Morgenstern teaches about a method of claim 14, 
wherein the network usage data set is in the standard data format "NAR format" received from a 
usage data collector having an encapsulator, an aggregator and a data storage system (Col 15, 
line 45-Col 16, line 15). 

In claim 16, Bullard combines with Morgenstern teaches about a method of claim 13, 
further comprising the step of defining the first rule set to be different than the second rule set 
(Covered in claim 1), 

In claim 17, Bullard combines with Morgenstern teaches about a method for recording 
network usage comprising the steps of (Fig 1): 

defining a first network data collector including a first encapsulator " NAR processing 
(Fig 14, 306, 302)", a first aggregator, and a first data storage system "Local store , (Fig 14, 
314)" (Col 15, line 45-Col 16, line 15); 

receiving a first set of network data via the first encapsulator (Col 15, line 45-Col 16, line 

15); 

processing the first network data set via the first aggregator, including the steps of 
defining an aggregation rule chain and determining a first set of aggregated data by applying the 
aggregation rule chain to the first set of network data (Covered in claim 1); and 

storing the first aggregated network data set in the first data storage system (Col 1 5, line 
45-Col 16, line 15). 
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In claim 18, Bullard combines with Morgenstern teaches about a method of claim of 
claim 17, wherein the step of applying the aggregation rule chain to the first set of network data 
further comprises the steps of: 

constructing an aggregation tree (Covered in claim 1); and 

determining the first aggregated network data set from the aggregation tree (Covered in 
claim 1). 

In claim 19, Bullard combines with Morgenstern teaches about a method of claim 18, 
wherein the step of constructing an aggregation tree further includes the steps of: 

defining the first network data set to includes a first network data event and a second 
network data event (Col 9, lines 46-55), (Col 17, lines 30-50); 

applying the aggregation rule chain (Covered in claim 1) to the first network data event to 
construct a hierarchy of group nodes within the aggregation tree (Col 15, line 45-Col 16, line 
15), (Col 18, line 39-Col 19, line 30); and 

applying the aggregation rule chain to the second network data event to locate similar 
group nodes according to a predefined set of match rules, if no matching group nodes exist, 
extending the hierarchy of group nodes within the aggregation tree by creating additional group 
nodes (Col 17, lines 30-50), (Col 18, line 39-Col 19, line 30). 

In claim 20, Bullard combines with Morgenstern teaches about a method of claim 19, 
wherein the step of applying the aggregation rule chain to the first network data event further 
includes the steps of: 

defining the aggregation rule chain to include a first match rule for matching source IP 
address (Col 13, lines 20-30), (Col 8, lines 15-38), (Table 1); 
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defining the first network data event to include a first source IP address(Col 13, lines 20- 
30), (Col 8, lines 15-38), (Table 1); 

applying the first match rule to the first network data event, including determining 
whether the aggregation tree includes a first group node matching the first source IP address; and 

if a matching first group node does not exist, creating the first group node for the first 
source IP address (Col 17, lines 30-50). 

In claim 21, Bullard combines with Morgenstern teaches about a method of claim 20, 
wherein the step of applying aggregation rule chain to the first network data event further 
includes the steps of: 

defining the aggregation rule chain to include a second match rule for matching 
destination IP address (Col 18, line 39-Col 19, line 30), (Covered in claim 1); 

defining the first network data event to include a first destination IP address(Col 13, lines 
20-30), (Col 8, lines 15-38), (Table 1); 

applying the second match rule to the first network data event, including determining 
whether the aggregation tree includes a second group node matching the first destination IP 
address (Col 18, line 39-Col 19, line 30), (Covered in claim 1); and 

if a matching second group node does not exist, creating the second group node for the 
first destination IP address (Col 18, line 39-Col 19, line 30). 

In claim 22, Bullard combines with Morgenstern teaches about a method of claim 21, 
wherein the step of applying the aggregation rule chain to the first network data event (Fig 21 , 
562a) further includes the steps of: 
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defining the aggregation rule set to include an aggregation rule (Col 18, lines 39- 

67); 

defining the first network data event to include a port number and volume of 
information (Col 8, lines 15-38), (Table 1); 

applying the aggregation rule to the first network data event, including copying 
the port number, source IP address, destination IP address and volume information to the second 
group node (Col 18, line 39-Col 19, line 30), (Covered in claim 1). 

In claim 23, Bullard combines with Morgenstern teaches about a method of claim 17, 
further comprising the steps of: 

defining a second network data collector (Fig 21, 562b) including a second encapsulator, 
a second aggregator, and a second data storage system (Col 15, line 45-Col 16, line 15); 

receiving a second set of network data via the second network encapsulator (Col 15, line 
45-Col 16, line 15); 

processing the second network data set via the second aggregator, including the steps of 
defining a second rule chain and applying the second rule chain to the second set of network data 
to define a second set of aggregated network data (Col 15, line 45-Col 16, line 15); and 

storing the second aggregated network data set in the second data storage system (Col 1 5, 
line 45-Col 16, line 15). (FDC has encapsulator, aggregator and data storage- see Fig 14). 

In claim 24, Bullard teaches about a network usage recording system having a network 
data collector, the network data collector comprising (Col 15, lines 45-67): 
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an encapsulator for receiving a set of network accounting data and converting the 
network accounting data set to a standard data format " NAR processing (Fig 14, 306, 302)", 
(Col 15, line 45-Col 16, line 15); 

an aggregator for processing the network accounting data set, the aggregator including a 
defined rule chain, wherein the aggregator applies the rule chain to the network accounting data 
set to construct an aggregation tree, and determines a set of aggregated network accounting data 
from the aggregation tree (Col 18, line 39-Col 19, line 30), (Covered in claim 1); and 

a data storage system for storing the aggregated network accounting data "Local store , 
(Fig 14, 314)" , (Col 16, lines 1-10). 

In claim 25, Bullard combines with Morgenstern teaches about a system of claim 24, 
wherein the process of applying the rule chain to the network accounting data performs data 
reduction on the network data (Col 17, lines 30-50), (Col 18, lines 39-67). 

In claim 26, Bullard combines with Morgenstern teaches about a network usage 
recording system having a network data correlator collector, the network data correlator collector 
comprising (FDC has encapsulator, aggregator and datastorage- see Fig 14) (Col 18, lines 39- 
67): 

an encapsulator, which receives a set of network session data " NAR processing (Fig 14, 
306, 302)" , (Col 18, lines 39-67); 

an aggregator for processing the network session data set, the aggregator including a 
defined first rule chain, wherein the aggregator applies the first rule chain (Morgenstern (Fig. 4, 
224) to the network session data set to construct an aggregation tree (Covered in claim 1); 
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wherein the encapsulator receives a set of network usage data, and the aggregator 
processes the network usage data set, the aggregator including a defined second rule 
chain(Morgenstern (Fig. 4, 220), wherein the aggregator applies the second rule chain to the 
network usage data set and the aggregation tree to construct a correlated aggregation tree, and 
determines a correlated data set from the correlated aggregation tree (Col 18, line 39-Col 19, line 
30), (Covered in claim !)■ and 

a data storage system for storing the correlated data set "Local store , (Fig 14, 314)" , 
(Col 16, lines 1-10). 

In claim 27, Bullard combines with Morgenstern teaches about a system of claim 26, 
wherein the network session data set is in a standard data format "NAR format" received from a 
session data collector having an encapsulator, an aggregator and a data storage system (Col 8, 
lines 15-38), (Table 1), (Col 15, line 45-Col 16, line 15). 

In claim 28, Bullard combines with Morgenstern teaches about a system of claim 27, 
wherein the network usage data set is in the standard data format "NAR format" received from a 
usage data collector (FDC has encapsulator, aggregator and data storage- see Fig 14) having an 
encapsulator, an aggregator and a data storage system (Col 8, lines 15-38), (Table 1), (Col 15, 
line 45-Col 16, line 15).. 

In claim 29, Bullard combines with Morgenstern teaches about a system of claim 26, 
further wherein the first rule set is different than the second rule set (Covered in claim 1). 

In claim 30, Bullard combines with Morgenstern teaches about a method for recording 
network usage comprising: 
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defining a first network data collector including a first encapsulator (Fig 21 , 562a) (Col 
15, lines 45-67), a first aggregator (Col 18, lines 40-50), and a first data storage system "Local 
store , (Fig 14, 3 14)" , (Col 16, line 1-10); (FDC has encapsulator, aggregator and data storage- 
see Fig 14) 

receiving a first set of network data via the first encapsulator (Fig 21, 562a) (Col 15, lines 

45-67); 

processing the first network data set via the first aggregator(Col 18, lines 40-50), 
including the steps of defining an aggregation rule chain and determining a first set of aggregated 
data by applying the aggregation rule chain to the first set of network data (Covered in claim 1); 
and 

storing the first aggregated network data set in the first data storage system (Col 18, lines 

50-67); 

wherein applying the aggregation rule chain to the first set of network data further 
comprises: 

constructing an aggregation tree (Covered in claim 1); and 

determining the first aggregated network data set from the aggregation tree (Col 19, line 

10-25); 

wherein constructing an aggregation tree further includes defining the first network data 
set to includes a first network data event and a second network data event (Col 19, line 10-25); 

applying the aggregation rule chain to the first network data event to construct a 
hierarchy of group nodes within the aggregation tree (Covered in claim 1); and 
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applying the aggregation rule chain to the second network data event to locate similar 
group nodes according to a predefined set of match rules (Col 19, line 10-25), (Covered in claim 
1), if no matching group nodes exist, extending the hierarchy of group nodes within the 
aggregation tree by creating additional group nodes (Morgenstern (Col 22, lines 40-60); The 
action of blocking the node until all distinct children nodes are completed is equivalent to 
creating a second group as in the case of the applicant. In both cases, the intention is to preserve 
the node until the data that is needed to generate the final output is available. 

wherein applying the aggregation rule chain to the first network data (Fig 21, 562a) event 
further includes: 

defining the aggregation rule chain to include a first match rule for matching source IP 
address (Col 8, lines 1-38), (Fig. 1 1c), (Covered in claim 1); 

defining the first network data event to include a first source IP address (Col 8, lines 1- 
38), (Fig. 11c); 

applying the first match rule to the first network data event, including determining 
whether the aggregation tree includes a first group node matching the first source IP address (Col 
8, lines 1-38), (Fig. 1 lc), (Fig. 18) (Covered in claim 1); and 

if a matching first group node does not exist, creating the first group node for the first 
source IP address (Col 19, line 10-25) (Morgenstern (Col 22, lines 20-45); The process of 
creating a tree 

wherein applying aggregation rule chain to the first network data event further includes: 
defining the aggregation rule chain to include a second match rule for matching 
destination IP address (Col 19, line 10-25), (Morgenstern (Col 22, lines 20-45); 
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defining the first network data event to include a first destination IP address (Col 8, lines 

1-38); 

applying the second match rule to the first network data event, including determining 
whether the aggregation tree includes a second group node "sub module" matching the first 
destination IP address (Morgenstern (Col 20, lines 45-55); and 

if a matching second group node "sub module" does not exist "not completed", creating 
the second group node for the first destination IP address (Morgenstern (Col 22, lines 40-60); 
The action of blocking the node until all distinct children nodes are completed is equivalent to 
creating a second group as in the case of the applicant. In both cases, the intention is to preserve 
the node until the data that is needed to generate the final output is available. 

wherein applying the aggregation rule chain to the first network data event further 
includes: 

defining the aggregation rule set to include an aggregation rule (Covered in claim 1); 
defining the first network data event to include a port number and volume of information 
(Col 8, lines 1-38); 

applying the aggregation rule to the first network data event, including copying the port 
number, source IP address, destination IP address and volume information to the second group 
node (Col 8, lines 1-38), (Col 19, line 10-25), (Fig. 18). 

In claim 31, Bullard combines with Morgenstern teaches about a method of claim 30, 
further comprising: 
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defining a second network data collector (Fig 21 , 562b) (FDC has encapsulate, 
aggregator and data storage- see Fig 14) including a second encapsulate" NAR processing (Fig 
14, 306, 302)" ,(Col 15, lines 45-67), a second aggregator(Col 18, lines 40-50), and a second 
data storage system "Local store , (Fig 14, 314)" , (Col 16, line 1-10); 

receiving a second set of network data via the second network encapsulator (Col 1 5, 
lines 45-67); 

processing the second network data set via the second aggregator(Col 15, lines 45-67), 
including: 

defining a second rule chain and applying the second rule chain to the second set of 
network data to define a second set of aggregated network data (Covered in claim 1); and 

storing the second aggregated network data set in the second data storage system (Col 18, 
lines 50-67). 



Conclusion 

4. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1. 136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
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however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

1 . The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

US Patent No. 6,230,203 by Koperda et al., teaches about a system and method for 
providing statistics for flexible billing in a cable environment. 

US Patent No. 6,446,200 by Ball et al., teaches about a Service management. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael S. A. Delgado whose telephone number is 703-305- 
8057. The examiner can normally be reached on 7.30 AM - 5.30PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, WILLIAM A CUCHLINSKI JR can be reached on (703) 308-3873. The fax phone 
number for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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